rain - Security Engineer - AppSec
Requirements
• 4+ years in application security, product security, or security-minded backend engineering • You've owned security decisions. You can tell a senior engineer their design needs to change and keep a good working relationship • You can read an unfamiliar codebase (TypeScript/Node.js) and find the bug that matters, and you know a scary-sounding finding from a real one • Hands-on cloud security (ideally GCP), Terraform, and edge defenses like WAFs and rate limiting • Experience with threat models or architecture reviews. You've run tool bake-offs and dropped tools that didn't earn their cost • You'd rather ship a check than write a document, and you use AI tools heavily without trusting them blindly • BONUS ATTRIBUTES • Fintech, payments, or card issuing background (PCI DSS a plus) • Pentest, bug bounty, or red team experience • Experience building security scanners, static analysis rules, or LLM-based review tools • If you have the background: AI security for our agents and agentic payments, or corporate security alongside IT • THINGS THAT ENABLE A FULFILLING, HEALTHY AND HAPPY EXPERIENCE AT RAIN: • Unlimited time off 🌴 Unlimited vacation can be daunting, so we require Rainmakers to take 10 days minimum for themselves. • Flexible working ☕ We support a flexible workplace – work from home, come into an office, or both. We want everyone to work in an environment where they're their most confident and productive selves. New Rainmakers receive a stipend to set up a comfortable home workspace. • Easy to access benefits 🧠 For US Rainmakers, we cover 95% of your health, dental, and vision plan costs and 90% for your dependents, plus a 100% company-subsidized life insurance plan. • Retirement goals💡 Plan for the future with confidence. We offer a 401(k) with a 4% company match. • Equity plan 📦 Every Rainmaker gets an equity option plan so we all benefit from our success. • Health and Wellness 📚 High performance begins from within. Rainmakers receive a monthly stipend to be used for eligible health and wellness spending like gym memberships/fitness classes, massages, acupuncture - whatever recharges you! • In-office meals 🍜 Rainmakers working from the office enjoy lunch and dinner on us, covered with a DoorDash credit. • Team summits ✨ Summits play an important role at Rain. Time together helps us build relationships and a common destiny. Expect team and company offsites, both domestic and international.
Responsibilities
• Review red team findings before they reach engineers: reproduce them, cut false positives, set severity, and write tickets clear enough to fix without a meeting. Improve the scoring that grades them • Harden our backend services and APIs, especially the money-moving paths. You'll often write the fix yourself • Own edge defenses: DDoS protection, rate limiting, WAF rules, and abuse controls • Write secure configuration baselines for our cloud, code, and SaaS, and turn them into automated checks • Grow our PR security gate so more bugs are blocked before merge • Own attack surface coverage, and run architecture reviews on new and high-risk systems • Find, test, and pick the best security tools, whether we buy, adopt, or build
Benefits
• $190K – $240K • Offers Equity • Offers Bonus • Upload your resume here to autofill key application fields. • Drop your resume here! • Parsing your resume. Autofilling key fields... • First and Last Name • Open to relocation • Open to discussing • or drag and drop here • Not right now, but in the future yes • What made you apply to this role at Rain? • Exclude internships or personal projects. Include jobs you've held after graduating university.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT